Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8b8907454e...1N.exe

windows7-x64

10

8b8907454e...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b8907454ef43aed7081a4e9c03dfb062e228d62d9ee24c4b2216ed92d5bcae1N

  • Size

    90KB

  • Sample

    240930-s5kzdashnm

  • MD5

    d4c090d529400d4801eaa99ef6a92390

  • SHA1

    10cd6b6d45fc435879989acb55a1a6e960328056

  • SHA256

    8b8907454ef43aed7081a4e9c03dfb062e228d62d9ee24c4b2216ed92d5bcae1

  • SHA512

    8824d6a30c601be9660dde5e789133f446df6c838e3ceeb2e791776d430adaf9a5111918d4f2427a849fd1c6f5976fd625fdae32fd4bc48bc973ff997135823b

  • SSDEEP

    1536:LlVOQeT3sez3qkz01A84V5JSZisItkdiJiPw8G2hu/Ub0VkVNK:PveT3sTkzMAj5JSZDItkIJqGAu/Ub0+U

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      8b8907454ef43aed7081a4e9c03dfb062e228d62d9ee24c4b2216ed92d5bcae1N

    • Size

      90KB

    • MD5

      d4c090d529400d4801eaa99ef6a92390

    • SHA1

      10cd6b6d45fc435879989acb55a1a6e960328056

    • SHA256

      8b8907454ef43aed7081a4e9c03dfb062e228d62d9ee24c4b2216ed92d5bcae1

    • SHA512

      8824d6a30c601be9660dde5e789133f446df6c838e3ceeb2e791776d430adaf9a5111918d4f2427a849fd1c6f5976fd625fdae32fd4bc48bc973ff997135823b

    • SSDEEP

      1536:LlVOQeT3sez3qkz01A84V5JSZisItkdiJiPw8G2hu/Ub0VkVNK:PveT3sTkzMAj5JSZDItkIJqGAu/Ub0+U

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks